[Alerts table] Edit tags UI #243792

benakansara · 2025-11-21T12:13:59Z

Release Notes

Users can now manually add workflow tags directly to alerts (see this PR as well)

Summary

Adds "Edit tags" in alert actions
Opens flyout when clicking on "Edit tags"
Flyout shows list of all kibana.alert.workflow_tags from the selected alerts
"Edit tags" will be disabled when all alerts are selected (as there can be 1000s of alerts with many tags)
"Edit tags" will not be available for Security rules

elasticmachine · 2025-11-21T20:21:15Z

Pinging @elastic/obs-ux-management-team (Team:obs-ux-management)

I removed useItemsAction here because that hook was designed for the alert update api, which does not easily support updating workflow tags. I moved the logic to useTagsAction instead. useItemsAction may come in use in the future if we decide to directly write to the tags field of an alert.

baileycash-elastic · 2025-11-25T04:20:03Z

I picked this up earlier today.

Note: I removed useItemsAction here because that hook was designed for the alert update api, which does not easily support updating workflow tags. I moved the logic to useTagsAction instead. useItemsAction may come in use in the future if we decide to directly write to the tags field of an alert.

other improvements

elasticmachine · 2025-12-03T01:41:58Z

Pinging @elastic/actionable-obs-team (Team:actionable-obs)

kibanamachine · 2025-12-03T17:00:18Z

Flaky Test Runner Stats

🟠 Some tests failed. - kibana-flaky-test-suite-runner#9973

[❌] x-pack/platform/test/alerting_api_integration/spaces_only/tests/alerting/group4/config.ts: 6/25 tests passed.

see run history

kibanamachine · 2025-12-03T20:20:08Z

Flaky Test Runner Stats

🎉 All tests passed! - kibana-flaky-test-suite-runner#9975

[✅] x-pack/platform/test/alerting_api_integration/spaces_only/tests/alerting/group4/config.ts: 25/25 tests passed.

see run history

kibanamachine · 2025-12-04T15:44:17Z

Flaky Test Runner Stats

🎉 All tests passed! - kibana-flaky-test-suite-runner#9980

[✅] x-pack/solutions/security/test/security_solution_api_integration/test_suites/detections_response/detection_engine/exceptions/operators_data_types/float/basic_license_essentials_tier/configs/serverless.config.ts: 25/25 tests passed.

see run history

cnasikas

LGMT! I found a bug. If you run Kibana with --run-examles and you create an Always firing rule, and then you go to the detailed page of the rule you see the following:

Screen.Recording.2025-12-05.at.1.42.14.PM.mov

cnasikas · 2025-12-03T16:33:54Z

src/platform/packages/shared/response-ops/alerts-table/components/tags/use_tags_action.test.tsx

nit: Should we test that the onAction* callbacks are being called correctly?

cnasikas · 2025-12-03T16:35:13Z

src/platform/packages/shared/response-ops/alerts-table/components/tags/use_tags_action.test.tsx

+    });
+  });
+
+  it('handles multiple alerts from different indices', async () => {


Note: Maybe we can remove this test as the indices are not being taken into account anymore.

cnasikas · 2025-12-03T16:49:17Z

...platform/packages/shared/response-ops/alerts-table/hooks/use_bulk_update_alert_tags.test.tsx

+    expect(onError).not.toHaveBeenCalled();
+  });
+
+  it('should update loading state during mutation', async () => {


Thank you so much for this great coverage!

nit: Maybe we can remove this test as it tests React query and there is no custom logic regarding the isLoading and isSuccess booleans.

cnasikas · 2025-12-05T12:22:34Z

src/platform/packages/shared/response-ops/alerts-table/components/tags/edit_tags_flyout.tsx

+  focusButtonRef?: React.Ref<HTMLButtonElement>;
+}
+
+const FlyoutBodyCss = css`


A reminder that the new flyout system is coming elastic/eui#9202 and these changes here may affect it.

src/platform/packages/shared/response-ops/alerts-table/components/tags/edit_tags_flyout.tsx

cnasikas · 2025-12-05T12:24:13Z

src/platform/packages/shared/response-ops/alerts-table/components/tags/edit_tags_flyout.tsx

+          <h2 data-test-subj="alerts-edit-tags-flyout-title">{i18n.EDIT_TAGS}</h2>
+        </EuiTitle>
+        <EuiText color="subdued">
+          <p>{headerSubtitle as string}</p>


nit:

Suggested change

<p>{headerSubtitle as string}</p>

<p>{headerSubtitle}</p>

cnasikas · 2025-12-05T12:24:55Z

src/platform/packages/shared/response-ops/alerts-table/components/tags/edit_tags_flyout.tsx

+        </EuiText>
+      </EuiFlyoutHeader>
+      <EuiFlyoutBody css={FlyoutBodyCss}>
+        {isLoading ? (


nit: As this is always set to false, probably we do not need this logic here.

cnasikas

LGTM! Thanks for your patience with my comments!

kibanamachine · 2025-12-05T15:52:15Z

Flaky Test Runner Stats

🟠 Some tests failed. - kibana-flaky-test-suite-runner#9995

[❌] x-pack/platform/test/alerting_api_integration/spaces_only/tests/alerting/group4/config.ts: 174/200 tests passed.

see run history

kibanamachine · 2025-12-05T18:11:02Z

Flaky Test Runner Stats

🎉 All tests passed! - kibana-flaky-test-suite-runner#9998

[✅] x-pack/platform/test/alerting_api_integration/spaces_only/tests/alerting/group4/config.ts: 25/25 tests passed.

see run history

elasticmachine · 2025-12-05T18:57:22Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: 5b1d30e

Failed CI Steps

Test Failures

[job] [logs] FTR Configs #23 / Alerting builtin alertTypes es_query rule runs correctly: threshold on ungrouped hit count < >
[job] [logs] FTR Configs #141 / EPM Endpoints Rollback APIs Package rollback input package should fail when at least one package policy has a previous revision with a different version

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`cases`	1200	1208	+8
`embeddableAlertsTable`	564	573	+9
`ml`	4172	4181	+9
`observability`	1618	1627	+9
`securitySolution`	8465	8473	+8
`triggersActionsUi`	1094	1103	+9
total			+52

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`cases`	1.4MB	1.4MB	+12.1KB
`embeddableAlertsTable`	1001.0KB	1013.6KB	+12.7KB
`ml`	5.5MB	5.6MB	+12.6KB
`observability`	1.7MB	1.7MB	+12.8KB
`securitySolution`	11.1MB	11.1MB	+12.1KB
`triggersActionsUi`	1.5MB	1.5MB	+12.8KB
total			+75.0KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`embeddableAlertsTable`	5.8KB	5.8KB	+1.0B
`observability`	95.7KB	95.7KB	-1.0B
total			-0.0B

History

💔 Build #369428 failed e369613
💚 Build #369283 succeeded a47954b
💔 Build #369238 failed ec64aa8
💛 Build #368719 was flaky 3d0b25b
💔 Build #368673 failed b13a985

cc @benakansara @baileycash-elastic

## Summary Closes elastic#240377 Closes elastic#240376 (with [this PR](elastic#243792)) <img width="1467" height="297" alt="Screenshot 2025-11-25 at 5 20 01 PM" src="https://github.com/user-attachments/assets/124ab28e-db22-4bc8-914d-31088930afea" /> <img width="1469" height="640" alt="Screenshot 2025-11-25 at 5 18 06 PM" src="https://github.com/user-attachments/assets/0a4874e1-6fbf-4355-a8b8-8d26c68b8492" /> ## Release Notes Users can now view and filter by workflow tags manually added to alerts --------- Co-authored-by: Faisal Kanout <[email protected]>

## Release Notes Users can now manually add workflow tags directly to alerts (see [this PR as well](elastic#244251)) ## Summary Part of elastic#240376 - Adds "Edit tags" in alert actions - Opens flyout when clicking on "Edit tags" - Flyout shows list of all `kibana.alert.workflow_tags` from the selected alerts - "Edit tags" will be disabled when all alerts are selected (as there can be 1000s of alerts with many tags) - "Edit tags" will not be available for Security rules --------- Co-authored-by: Bailey Cash <[email protected]> Co-authored-by: kibanamachine <[email protected]> Co-authored-by: Christos Nasikas <[email protected]>

benakansara added 4 commits November 21, 2025 15:14

init commit

2eb386f

show edit tags flyout

035d5c8

add tests

40057f8

cleanup

f9a3c60

benakansara self-assigned this Nov 21, 2025

benakansara added release_note:skip Skip the PR/issue when compiling release notes backport:skip This PR does not require backporting Team:actionable-obs Formerly "obs-ux-management", responsible for SLO, o11y alerting, significant events, & synthetics. labels Nov 21, 2025

github-actions bot added the author:obs-ux-management PRs authored by the obs ux management team label Nov 21, 2025

benakansara and others added 7 commits November 21, 2025 17:46

Merge branch 'main' into feat/edit-workflow-tags

f813798

do not show edit tags for sec rules

41a3964

fix ci errors

bff28f2

fix tests

caf9e6e

Merge branch 'main' into feat/edit-workflow-tags

eb81276

refactoring

142476d

refactoring

18d37d1

benakansara marked this pull request as ready for review November 21, 2025 20:21

benakansara requested a review from a team as a code owner November 21, 2025 20:21

baileycash-elastic and others added 2 commits November 24, 2025 10:46

Merge branch 'main' into feat/edit-workflow-tags

808da51

Changes from node scripts/regenerate_moon_projects.js --update

b81e7ee

elastic-vault-github-plugin-prod bot requested a review from a team as a code owner November 24, 2025 16:07

baileycash-elastic self-assigned this Nov 24, 2025

Ikuni17 approved these changes Nov 25, 2025

View reviewed changes

hook cleanup, fix tests

af1c1ce

other improvements

baileycash-elastic force-pushed the feat/edit-workflow-tags branch from 13c0b95 to af1c1ce Compare November 25, 2025 17:43

baileycash-elastic requested a review from a team as a code owner November 25, 2025 17:43

fix typing compile issue

cc7fd94

baileycash-elastic added 2 commits December 2, 2025 21:15

fix nits, add api assertions to tag action tests

6f522bf

add capabilities check to tags

d7badb2

baileycash-elastic requested a review from cnasikas December 3, 2025 03:29

add tests for edit action

8569255

baileycash-elastic added 2 commits December 3, 2025 13:41

attempt to fix flaky test

20a8847

other flaky test fix

b13a985

baileycash-elastic added 2 commits December 3, 2025 16:03

Merge branch 'main' into feat/edit-workflow-tags

3d0b25b

Merge branch 'main' into feat/edit-workflow-tags

4589b85

baileycash-elastic and others added 4 commits December 4, 2025 15:52

Merge branch 'main' into feat/edit-workflow-tags

ec64aa8

Merge branch 'main' into feat/edit-workflow-tags

a47954b

update header

f609083

Merge branch 'main' into feat/edit-workflow-tags

e369613

cnasikas reviewed Dec 5, 2025

View reviewed changes

cnasikas mentioned this pull request Dec 5, 2025

[ResponseOps][Alerts table] Remove the hardcoded index pattern when editing tags in the alerts table #245378

Open

baileycash-elastic and others added 2 commits December 5, 2025 09:57

simplify tests, address feedback

57e4e10

fix close flyout on error

b49a6cc

cnasikas approved these changes Dec 5, 2025

View reviewed changes

Merge branch 'main' into feat/edit-workflow-tags

5b1d30e

benakansara enabled auto-merge (squash) December 5, 2025 18:15

benakansara merged commit 3ec41c8 into elastic:main Dec 5, 2025
12 checks passed

kibanamachine added the v9.3.0 label Dec 5, 2025

[Alerts table] Edit tags UI #243792

[Alerts table] Edit tags UI #243792

Uh oh!

Conversation

benakansara commented Nov 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Summary

Uh oh!

elasticmachine commented Nov 21, 2025

Uh oh!

baileycash-elastic commented Nov 25, 2025

Uh oh!

elasticmachine commented Dec 3, 2025

Uh oh!

kibanamachine commented Dec 3, 2025

Flaky Test Runner Stats

🟠 Some tests failed. - kibana-flaky-test-suite-runner#9973

Uh oh!

kibanamachine commented Dec 3, 2025

Flaky Test Runner Stats

🎉 All tests passed! - kibana-flaky-test-suite-runner#9975

Uh oh!

kibanamachine commented Dec 4, 2025

Flaky Test Runner Stats

🎉 All tests passed! - kibana-flaky-test-suite-runner#9980

Uh oh!

cnasikas left a comment

Choose a reason for hiding this comment

Uh oh!

cnasikas Dec 3, 2025

Choose a reason for hiding this comment

Uh oh!

cnasikas Dec 3, 2025

Choose a reason for hiding this comment

Uh oh!

cnasikas Dec 3, 2025

Choose a reason for hiding this comment

Uh oh!

cnasikas Dec 5, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cnasikas Dec 5, 2025

Choose a reason for hiding this comment

Uh oh!

cnasikas Dec 5, 2025

Choose a reason for hiding this comment

Uh oh!

cnasikas left a comment

Choose a reason for hiding this comment

Uh oh!

kibanamachine commented Dec 5, 2025

Flaky Test Runner Stats

🟠 Some tests failed. - kibana-flaky-test-suite-runner#9995

Uh oh!

kibanamachine commented Dec 5, 2025

Flaky Test Runner Stats

🎉 All tests passed! - kibana-flaky-test-suite-runner#9998

Uh oh!

Uh oh!

elasticmachine commented Dec 5, 2025

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

Metrics [docs]

Module Count

Async chunks

Page load bundle

History

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

benakansara commented Nov 21, 2025 •

edited

Loading